fix: remove unnecessary users.info calls from usergroup grants

[btipling]

Summary

• Removes per-member users.info API calls from usergroup grants
• Constructs the user resource ID directly from the Slack user ID (which we already have from the member list)
• Eliminates the rate limit problem for usergroup grants entirely — zero API calls per member

Context

Resolves CXH-1301

The Grants method was calling users.info for every group member to build a full user resource, then only using ur.Id from it to create the grant. The user ID needed for the resource ID is the same Slack user ID we already have from GetUserGroupMembersContext. The full user profile fetch was completely unnecessary.

Test plan

• Run sync against workspace with large usergroups — verify grants complete without any 429s on users.info
• Verify grant data is correct (user resource IDs match)

🤖 Generated with Claude Code

[linear]

CXH-1301 Slack connector never works for Verkada tenant

[github-actions]

PR Review: Remove unnecessary users.info calls from usergroup grants

• Gather context and read changed files
• Review code changes
• Post review feedback

View job run

[github-actions]

Claude finished @btipling's task in 1m 0s —— View job

---

PR Review: Remove unnecessary users.info calls from usergroup grants

• Gather context and read changed files
• Review code changes
• Post review feedback

Verdict: Approve ✅

This is a clean, well-scoped optimization. The change is correct and safe.

What changed

In Grants() (pkg/connector/user_group.go:166-171), the old code called o.client.GetUserInfoContext() for every group member, built a full user resource via userResource(), and then only used the .Id field to create the grant. The new code constructs the resource ID directly with resource.NewResourceID(resourceTypeUser, member).

Why this is correct

The resource ID for a user is determined by the resource type + the Slack user ID. Both paths produce identical IDs:

• Sync (List): resource.NewUserResource(user.Name, resourceTypeUser, user.ID, ...) → internally calls NewResourceID(resourceTypeUser, user.ID) (user.go:142-145)
• Grants (new): resource.NewResourceID(resourceTypeUser, member) where member is the same Slack user ID from GetUserGroupMembersContext

The IDs will match because they use the same resource type and the same Slack user ID string.

Other observations

• No unused imports — client and slack packages are still used elsewhere in the file (lines 82-84, 144).
• Error prefix follows the baton-slack: convention per CLAUDE.md guidelines.
• Pagination logic is unchanged and correct.
• The outputAnnotations variable on line 141 is now only used for the GetUserGroupMembersContext error path (line 144) and the return (line 180), which is fine.

No issues found. Nice improvement — eliminates N API calls per page of usergroup members.